Firewall issue - tcp outbound port 443

Hello,
I have a server-side programming language that I am trying to connect from my webserver to a payment gateway via a tcp connection on port 443. For some reason, I can't connect to the host from my server (Snow Leopard Server). I can use the same code however on my local laptop, in the same network, and connect just fine.
Any ideas?
Both machines are behind my Airport Base Station using port forwarding. I do have port forwarding enabled for port 443 in the airport which points to my Snow Leopard Server local I.P. address.
Thanks for any thoughts.
Donovan

Well, I spoke too soon.. the firewall *is* the problem.
There must have been a cache when I stopped it, which made it appear as if the fix was in the Airport Extreme. However, after turning the firewall back on, the issue came back. I've now done more testing, and the issue definitely involves the firewall.
In Server Admin, I have the following Active Rule in the firewall:
'Allow tcp from any to any dst-port 443'
I am guessing that my server-side language "tcp connection" is being seen in that rule. I was told it is like a telnet connection. Is there a different rule that I should put in to allow telnet connections on port 443? I would think the same rule would work for both.
Anyway, saga continues.
Donovan

Similar Messages

How do i temporarily disable TLS/SSL port 443 going to server on CSS

We are having issues with truncating packets that go through the CSS
I did a capture after the CSS and there is truncation............however i cant read it before the since everything is encrypted.
They hit vip address 172.20.120.16. on the CSS and get redirected to 2 servers depening on what the url says
They server team would like to turn it off just to test..i tried removing
"add service ARR-public-ssl" from the contetn below and we lost http and https to the server
so in essence i want to try and turn the 443 connection to a port 80---than it goes to port 7777 backend to 172.20.212.6
content BYE-WEB-SSL
   vip address 172.20.120.16
   protocol tcp
   port 443
   advanced-balance ssl
   application ssl
   add service ARR-public-ssl
   active
ssl-server 40
ssl-server 40 rsacert byetest
ssl-server 40 vip address 172.20.120.16
ssl-server 40 cipher rsa-with-rc4-128-sha 172.20.120.17 80
ssl-server 40 cipher rsa-with-rc4-128-md5 172.20.120.17 80
ssl-server 40 urlrewrite 1 *
ssl-server 40 cipher rsa-with-3des-ede-cbc-sha 172.20.120.17 80
ssl-server 40 rsakey byekey
backend-server 50
backend-server 50 type initiation
backend-server 50 server-ip 69.xxx.xxx.xxx
backend-server 50 ip address 69.xxx.181.xxx
backend-server 50 rsacert byetest
backend-server 50 rsakey byekey
active
!************************** SERVICE **************************
service TIE-SSLINIT
protocol tcp
ip address 69.xxx.xxx.xxx
keepalive type tcp
keepalive port 443
slot 2
type ssl-init
add ssl-proxy-list HR-SSL
active
owner PublicBYE
content BYE-WEB-ARRR
    vip address 172.20.120.17
    protocol tcp
    port 80
    url "/arr*"
    advanced-balance arrowpoint-cookie
    balance aca
    arpt-lct http-100-reinsert
    add service BYE-ods-web1
    active
content BY-WEB-TIX
    protocol tcp
    port 80
    url "/tix*"
    advanced-balance arrowpoint-cookie
    balance aca
    arpt-lct http-100-reinsert
    add service BYE-ods-web2
    vip address 172.20.120.17
    active
content BYE-WEB-TIX-CLEARTEXT
    add service TIX-SSLINIT
    vip address 172.20.120.19
    protocol tcp
    port 80
    active
content BYE-WEB-Nav
vip address 172.20.120.17
protocol tcp
port 80
url "/na*"
balance aca
arpt-lct http-100-reinsert
add service BYE-ods-web1
active
content BYE-WEB-SSL
vip address 172.20.120.16
protocol tcp
port 443
advanced-balance ssl
application ssl
add service ARR-public-ssl
active
service BYE-ds-web1-ssl
ip address 172.20.212.5
port 443
keepalive type ssl
active
service BYE-ds-web2
ip address 172.20.212.6
port 7777
keepalive port 7777
keepalive type tcp
active
service BYE-ds-web2
ip address 172.20.212.6
port 7777
keepalive port 7777
keepalive type tcp
active
service BYEos-web2-ssl
ip address 172.20.212.6
port 443
keepalive type ssl
active

CSS11506# sh ver
Version:               sg0810205 (08.10.2.05)
Flash (Locked):        08.10.1.06
Flash (Operational):   08.10.2.05
Type:                  PRIMARY
Licensed Cmd Set(s):   Standard Feature Set
                       Secure Management
Yeah..if done a packet trace before it hits the CSS and after......the only issue is that everything is engrypted before it hits the LB so i cant really read anythign....i did a pacet trace after the LB and on the Server itself its seems we get this
I thought i saw some bug info from cisco but i cant tell if its related
CSCsx05640—When you configure the CSS for a Layer 5 (L5) content rule and it receives an HTTP method POST with the HTTP header in one packet that is quickly followed by many packets of POST data or payload, it could fail to deliver all the data to the back-end server. The CSS Flow Manager (FM) application could incorrectly handle the POST and the data packet as a spanned content request and could cause the data to be mishandled. Workaround: Use less than 1-Gb connections in the network; a 100-Mb link does not exhibit this issue.
As you can see after the content-length..........nothing comes across........sometimes addtional stuff will come in ...but usually nothing
Is there a bug related to this on the CSS?
POST /TIXX/DocumentRepository_Service HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: application/soap+xml;charset=UTF-8;action="urn:ihe:iti:2007:ProvideAndRegisterDocumentSet-b"
User-Agent: Jakarta Commons-HttpClient/3.1
Host: www.xxxxxxxxxxxx.net
Content-Length: 9044

Firewall issue with centralized SQL server - port 52384

Hi,
I have dedicated, centralized MS SQL 2012 server for our internal infrastructure with few instances. There is dedicated named instance SC for SC Family Products running on TCP port 1435. Also Server Browser running on UDP 1434 is enabled. I'm trying to install
SCOM 2012 R2. I got to the step Configure the Operational Database and here, I encountered a problem. I try to connect to my SQL server and put into
Server name and instance name SQL\SC and into SQL Server port 1434 or 1435, it doesn't connect. If I turn off firewall on SQL server, it connects without problems. On SQL server, I already have allowed incoming communication on ports UDP 1434
and also TCP 1433-1436. Than, I found out, that I need to allow in TCP 135 so I did it. It didn't work. Than I allowed TCP 49154-49157 for reporting services - it still didn't work. Last thing I allowed (using Microsoft Network Monitor) was TCP port 52384
and suddenly, it worked .
I know what UDP 1434 and TCP 1433-1436 are for. Also, I understand why I have to open 135 and 49154-49157. But I am pretty confused by the port 52384 - what is it for ? Why it isn't mentioned in documentation ? I am pounding with this problem for a while,
and also, I found out, that my SC VMM is not working, if I do not allow all of these ports - so, probably not only used by SCOM ?
Can anyone explain what's that port for ? Or why it's not enough to open 1434, 1433-1436, 135 and 49154-49157 ?
Thanks
Tomas

Hi,
I didn't install SCOM yet. I am stuck at installation, till I figure out why port 52384 needs to be opened.
1. My SQL Server Configuration Manager is set like this:
Protocols for SC - TCP/IP Enabled
IP2
Active : Yes
Enabled : Yes
IP Address : ipv4 ip address of server
TCP Dynamic Ports : (blank)
TCP Port : 1435
So, that should be ok, right?
2. If I turn off firewall on SQL, everything connects ok - so based on that, I suppose that SCOM server firewall is configured ok . It's issue on SQL.
On SQL server, I have these inbound rules:
COM+ Network Access (DCOM-In) - TCP 135 enabled
HTTP/HTTPS - TCP 80,443 enabled
SCOM Reporting - TCP 49154-49157 enabled
SQL UDP ports - UDP 1433-1437 enabled
SQL TCP ports - TCP 1433-1435 enabled
SCOM 52384 - TCP 52384 enabled <- this is the port I don't understand, why it should be opened
If I disable any of these rules, my connection will not pass. I figured out those ports using Microsoft Network Monitor on SQL server.
3. Those databases do not exist yet. I am stuck at 3th step of Operations Manager Setup - at Configure the operational database.
There are fields Server name and instance name, SQL Server port, Database name, Database size, Data file folder, Log file folder
. First two are writable and the rest is greyed out. If I don't turn off firewall and I don't enable all rules from point 2 on SQL server and than put in the SQL server name with instance (SQL\SC) and port 1434 (or 1435) it gives
me red cross, and rest of the page stays greyed out - so, it's unable to connect. If I turn off firewall, or enable all the rules in previous point (2) I am able to change name of the database, database size, data/log file folder. But if I disable any
of those ports, it stays greyed out - I am concerned about port 52384, why it should be opened? What is it for? Why it isn't mentioned in any documentation? Or am I doing something wrong?
Thanks
Tomas

Which TCP/UDP ports need to be opened on a firewall for adobe reader and flashplayer?

Which TCP/UDP ports need to be opened on a firewall for adobe reader and flashplaer to operate properly? This would include updating, linking, and any subset of features.

The Acrobat Family uses TCP HTTP/HTTPS for all traffic. The following processes and ports may be active on a Windows client machine:
AdobeARM.exe - automatic updates - port 443
AcroRd32.exe - brand messages - port 443
AcroRd32.exe - links in documents - anything specified in the URL
Acrobat.exe - brand messages - port 443
Acrobat.exe - links in documents - anything specified in the URL
AdobeCollabSync.exe - Tracker review data - port 443
The same ports are used by the program components on OS X.
There are no inbound listening ports for any elements of the Acrobat Family. Automatic updates are not pushed and there are no server processes within the software.

TCP/UDP Ports and site used by FEP to download updates - needed to allow on perimeter firewall

Can some one point me with information like what TCP/UDP ports are utilized by FEP and what DNS / site Name it uses to download FEP Updates. This is needed to tighten perimeter FireWall policies
Thank you

It should be the same as the documentation for all Software Updates:
https://technet.microsoft.com/en-us/library/bcf8ed65-3bea-4bec-8bc5-22d9e54f5a6d#BKMK_ConfigureFirewalls
Make sure to expand the "restrict access to specific domains" section to see the update related URLs.

RMI firewall issue - opening port 1099 is not enough

Hello,
We have a distributed java desktop app that uses RMI with callbacks to communicate amongst the clients. It all works really well at our dev site and at 2 trial sites.
We are about to deploy out to more customer sites - so I have been doing more testing with firewalls etc and discovered some issues. Our customers are small businesses and typically have between 1 and 10 desktop clients that connect to the server via RMI. These customers are "very NOT technical", so we need to give them set-and-forget firewalls etc.
This is all on a LAN, with RMI using port 1099. On the firewalls (of the various PCs) we open ports 1099 (RMI) and 5432 (for the Postgres DB).
Also, I was using "CurrPorts" and "SmartSniff" to monitor the traffic at each PC - so I had a reasonable view of proceedings.
Basically, opening port 1099 on the server is necessary, but it is NOT ENOUGH. The RMI moves off to ports other than 1099, and the server firewall does not allow the connection.
Procedure ...
(1) start the "server" app - which starts the RMI registry - the "localhost" desktop app also starts and it works well to both the database and the RMI.
(2) start another client - it connects to the DB Server, but NOT the RMI server.
(3) open the server firewall to all traffic for a few seconds - then the client connects successfully.
From CurrPort logging I could watch the RMI comms progress over those first few minutes ...
Initially the comms do include port 1099 on the initial call to the server, but there after there are always 2 or 3 "channels" open, but not to 1099.
I notice that the Postgres DB keeps using port 5432 for all of its active channels - so it does not have the same firewall issue.
After we have opened the firewall for a few seconds - to enable the link - then we can turn the client on and off and the client re-connects without issue - so it would seem to be only an issue with the initial connection.
I am sure that this is all completely standard and correct RMI behavior.
QUESTIONS:
1. Can RMI be "forced" to always use port 1099 for connections, and not move to other ports? (like the database uses 5432)
2. Are there any suggestions for getting around this seemingly standard RMI behaviour?
Other comments ...
The firewall lets me open individual ports (say 1099) - BUT I can not justify opening ALL ports.
The firewall lets me open all ports to an application, say "C:\Program Files\Java\jre6\bin\java.exe", but that app will occasionally change at a customer's site as they will update their java version and suddenly our app will stop working.
Any guidance is appreciated.
Many Thanks,
-Damian

1. Can RMI be "forced" to always use port 1099 for connectionsYes. Export all your servers on the same port. See UnicastRemoteObject constructor that takes an int, or UnicastRemoteObject.exportObject(int). If the RMI Registry is a separate process you can't re-use 1099 for this purpose, but see below.
2. Are there any suggestions for getting around this seemingly standard RMI behaviour?Yes. Start the RMI Registry in the same JVM as the code, then you only need to use 1099 for everything.
If you are using server socket factories, make sure they have an equals() method, or use the same instance for all remote objects.

Firewall Port 443

Is it dangerous to open Port 443 in the Firewall?
I'm sharing internet of my Powerbook for my MacMini via Airport.
Internet Banking and aktualising Tv programs for EyeTV only works when Firewall on Powerbook is off , or port 443 is opened.
Is it safer to switch off firewall only when I need these services?

443 doesn't look like a big problem since it's used for https...
http://www.auditmypc.com/port/udp-port-443.asp

Help!!!!!!!!!!!!! Port 443 Issue

Can any one tell me how to open port 443 on my wireless router model WRT54G3G-AT? For a secure business connection. Plese don't give me a link to follow, I've tried that one.
Thanks,
A

Hi! Are you trying to access your router remotely via HTTPS? You just need to enable it thru the router's setup page > Administration > Access Sever > HTTPS (check the box to enable it).

Stratus tunneling over ports 443 and/or 80

Would it be possible to have Stratus listen on ports 443 and
80; and would Flash Player 10 indeed fall back to those ports, as
with FMS?
I am dealing with a customer who has difficulty opening 1935
due to corporate policies.
I have no information about port 10000+. Hopefully they pose
no problem.
Kind Regards,
Frans

The older RTMP operates over TCP port 1935 and falls back to
tunneling over 443 and/or 80.
The newer RTMFP uses UDP and requires the ability to make
outbound connections to 1935 and also higher port numbers in order
to establish a server connection.
Running over port 443 and 80 UDP wouldn't help, the firewall
is likely configured to open up TCP 443 (HTTPS) and TCP 80 (HTTP)
while still blocking UDP.
If your application needs to work in the presence of
UDP-blocking firewalls (and note that we do several things to get
through them, if they do allow internally-initiated UDP sessions),
you'll need to code your own fallback to a TCP protocol like RTMP
or HTTP.

Windows Firewall issue, Inbound rule opend all, still not the same as turning off

This is Windows Firewall issue on Windows 8.1 Pro.
Backup Exec server cannot expand a computer node in selection list. I drill down to Microsoft Windows Network/Domain/Computers, then when I tried to expand a Windows 8.1 Pro computer node, it hangs out.
I narrowed this problem to Windows firewall related issue on Windows 8.1 Pro computer.
When I turn off Windows Firewall on Domain profile, Backup Exec Selection expands the computer node of the Windows 8.1 Pro computer. So, I created an inbound rule opening all to BAckup Exec server as following, but it's still not the same as turning off
Windows firewall specifically on Windows 8.1 Pro computer;
Any Local IP address, Any Remote IP address, Any port, Any protocol, All Interface, All Programs and Services, All profiles(Domain, Private, Public)
And there are no rules blocking any which may override the above rule.
Ethernet on Windows 8.1 Pro computer shows profile is linked with Domain, but just to make it work, I selected all profiles.
Even though I opened all available in inbound rule, it's still not the same as turning off windows firewall. Why am I missing?

It looks as something related to RPC(UDP 135), but even when inbound rule is all open, why it matters? RPC seems working fine only when firewall is turned off on domain profile.
Protocol 17 is UDP
Port: 135
===============================
Event ID 5152
The Windows Filtering Platform has blocked a packet.
Application Information:
Process ID:
0
Application Name:
Network Information:
Direction:
Outbound
Source Address:
192.168.1.120
Source Port:
0
Destination Address:
192.168.1.11
Destination Port:
0
Protocol:
1
Filter Information:
Filter Run-Time ID:
245836
Layer Name:
ICMP Error
Layer Run-Time ID:
32
The Windows Filtering Platform has blocked a packet.
Application Information:
Process ID:
0
Application Name:
Network Information:
Direction:
Inbound
Source Address:
192.168.1.11
Source Port:
35341
Destination Address:
192.168.1.120
Destination Port:
135
Protocol:
17
Filter Information:
Filter Run-Time ID:
245834
Layer Name:
Transport
Layer Run-Time ID:
13

Non SSL website on port 443

Hi, I have a non-SSL website running on port 443. When I access this website using Chrome or IE it works just fine, but Firefox can't seem to accept what I have done. All browsers on the same machine and using the same web proxy.
I access the website as http://xyz:443.
Just a bit of background info as to why I need this. Where I work I can only access ports 443 and 80 via the web proxy. I have two distinct websites running on a couple of devices at home behind a very config-wise limited router which has ports 80 and 443 redirected to these hosts. There is no way for me to setup two port forward rules on port 80 to two different devices. I cannot setup SSL on either of the websites.
Regardless of options that could exist to overcome my particular issue, I would like to check if you guys know how to make Firefox work with a website running on port 443 whilst not having a certificate assigned to it.
Firefox 32.0.3
Error message:
The connection was reset
The connection to the server was reset while the page was loading.
The site could be temporarily unavailable or too busy. Try again in a few moments.
If you are unable to load any pages, check your computer's network connection.
If your computer or network is protected by a firewall or proxy, make sure that Firefox is permitted to access the Web.

What type of ssl are you running? [https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/]
You can somehow remove the Strict-Transport-Security header or if there is a feature that forced encryption but by default https uses 443 for encryption. I do not know if this is possible.

IE Traffic being forced to tunnel via port 443

I have a Windodws 2008 R2 server that has been in production for over 2 years. It is a Hyper-V host running five 2008 R2 guests. Everything wasw running fine until a couple of weeks ago when I installed the latest HP firmware and drivers.
Since then, Internet Explorer cannot open any website except
www.google.com. After uninstalled IE9 and then installing IE10 there was no change. I've scanned the server with malwarebytes and HiJackThis. No problems found. I reset IE and reset the TCP/IP stack. No change. I removed
McAfee AV and I'm now able to access google and one other site. I then installed Fiddler and looked at what is happening and it appears that most websites are trying to tunnel using port 443 rather than using the typical port 80. I'm not sure how
to interpret this. I know name resolution is working and can ping the sites I'm trying to reach. If I go to a standard site, say
www.yahoo.com, the IE window stays blank but if I go to Tools/View Source it appears I'm looking at the HTML from the target site. Below is a summary of the Fiddler output when I tried to go to yahoo.com. Any help
is greatly appreciated as I am all out of ideas.
Thanks,
Joe
# Result Protocol Host URL Body Caching Content-Type Process Comments Custom
1 301 HTTP fiddler2.com /UpdateCheck.aspx?isBeta=False 0 no-cache  fiddler:4916
2 200 HTTP www.telerik.com /updatecheck.aspx?isBeta=False 620 private text/plain; charset=utf-8 fiddler:4916
3 301 HTTP www.yahoo.com / 212 no-store text/html iexplore:728
4 200 HTTP Tunnel to www.yahoo.com:443 0   iexplore:728
5 - HTTP crl.geotrust.com /crls/secureca.crl -1   iexplore:728
6 200 HTTP Tunnel to www.yahoo.com:443 0   iexplore:728
7 200 HTTP Tunnel to iecvlist.microsoft.com:443 0   iexplore:5104

Found that the problem was somewhere in the Windows firewall. Although I had stopped the firewall service during testing something remained hooked in. Another attempt at shutting off the firewall and then starting it again seems to have resolved
the problem. This makes no sense but I'm not arguing with the results. Thanks everyone for your help.

TCP's port mapping for safe access

So, I have a statical IP and need to organize safe access to my domestic NAS via Capsule from Global Internet, it means I need https://.
As I know (may be it's not) TCP's set 443 can provide https:// only.
I could not find such TCPs pre-set in Capsule.
I tried to use all pre-set (one after the other) and even made a new set with TCP 443 (just by hand), but all my attempts ended by changing TCP's 443 to 8080 automatically and I saw https:// when I tried to make a safe enter.
Pls., explain, how can I do it?
Thanks' a lot advance.

You have to map port 443 to the NAS IP in your local lan..
You should be able to access it no problem.. there is nothing preset on the TC.
Read the instructions by Tesserax on port mapping for v5 or v6 utility depending on which one you use.
https://discussions.apple.com/community/wireless/airport?view=documents
IMHO if your TC is not the latest AC you will have far more success with v5 utility.
v6 seems to have issues making it stick.
You can load the older version into Mountain Lion .. but according to your profile you are on 10.6 so still fine for v5.

HTTPS (port 443) for RVS4000 Router

Hello All
I have two servers - one running MS exchange and the other running a crm platform and both must be access via https. On the router -I have bound https to one ip address and router refuses to accept the binding of the same port 443 to another ip address. I will appreciate any help I can get towards resolving this.
The network diagram is attached.

Hello!
Unfortunately it is not possible to have same port forwarded simultaneously to several internal IP addresses - just imagine even if this setting would be possible, how the router will know which request to which internal server to forward since the port where request was received is the same?
However, with RVS4000 you can do the following - use TCP 443 for server1 and let's say TCP 4443 for server2.
Let's assume that your servers have the following IP address assignement:
Server1 - 192.168.8.100
Server2 - 192.168.8.101
In RVS4000 go to Firewall -> Single Port Forwarding
Configure it as on the screenshot:
After that you can access from the Internet both servers using the following URL:
Server1 - https://wan_ip_address
Server2 - https://wan_ip_address:4443
Hope it will solve your problem!
Best regards,
Ivan Bondar
Cisco Small Business Support

Unable to connect to database; verify that database TCP/IP port service is

Hi i have a problem with a few servers when i'm trying to upgrade from SAP 2007 SP00 PL47 to SAP 2007 SP1 PL06, i run the upgrade for SBO-COMMON and gives me the message Unable to connect to database; verify that database TCP/IP port service is started, and i don't know why, i hope you can help me.
Julieta

Hi,
Ensure that the connection to the database is configured properly.
1. Check that the TCP/IP port is not being blocked by a Firewall.
2. Set the Server's Remote Connection to accept TCP/IP connections.
Microsoft SQL Server 2005 -> Configuration Tools -> SQL Server Surface Area Configuration -> Server Surface Area Configuration for Services and Connections -> MSSQLSERVER -> Database Engine -> Remote Connections
Restart the 'SQL Server (MSSQLSERVER)', and run the upgrade again.
Hope this will resolve your issue !

Firewall issue - tcp outbound port 443

Similar Messages

Maybe you are looking for